watch-outbound: extend INTEL allowlist with RIRs, CZDS, 2026-era patterns

0d22891b1c360f4ac80cecab73e2a878335766b5 · 2026-05-12 18:49:47 -0700 · steve

honeypot.js v1 parser audit: whoisQuery is single-layer (clean), and
godaddyApi has a benign mis-tally on JSON-shaped API errors but it's
the lure phase where DoH-at-check is ground truth, so snipe detection
is unaffected. No fix needed.

watch-outbound DOMAIN_INTEL_PATTERNS gaps filled (35 -> 47 patterns):
  - 5 RIRs (arin/ripe/apnic/lacnic/afrinic) — IP/ASN lookups that
    typically precede or accompany domain-intel research
  - 2 ICANN services (czds.icann.org for zone data, lookup.icann.org)
  - 5 newer aggregators / new-TLD registries (centralnic, donuts.email,
    humbleworth, sav.com, spaceship)
  - api.certspotter.com — we use it ourselves but tracking outbound
    helps with budget audit if a paid key lands later.

Files touched

M watch-outbound.js

Diff

commit 0d22891b1c360f4ac80cecab73e2a878335766b5
Author: steve <steve@designerwallcoverings.com>
Date:   Tue May 12 18:49:47 2026 -0700

    watch-outbound: extend INTEL allowlist with RIRs, CZDS, 2026-era patterns
    
    honeypot.js v1 parser audit: whoisQuery is single-layer (clean), and
    godaddyApi has a benign mis-tally on JSON-shaped API errors but it's
    the lure phase where DoH-at-check is ground truth, so snipe detection
    is unaffected. No fix needed.
    
    watch-outbound DOMAIN_INTEL_PATTERNS gaps filled (35 -> 47 patterns):
      - 5 RIRs (arin/ripe/apnic/lacnic/afrinic) — IP/ASN lookups that
        typically precede or accompany domain-intel research
      - 2 ICANN services (czds.icann.org for zone data, lookup.icann.org)
      - 5 newer aggregators / new-TLD registries (centralnic, donuts.email,
        humbleworth, sav.com, spaceship)
      - api.certspotter.com — we use it ourselves but tracking outbound
        helps with budget audit if a paid key lands later.
---
 watch-outbound.js | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/watch-outbound.js b/watch-outbound.js
index 7e4a01f..ce7ca60 100644
--- a/watch-outbound.js
+++ b/watch-outbound.js
@@ -71,6 +71,23 @@ const DOMAIN_INTEL_PATTERNS = [
   'pool.com',
   'expireddomains',
   'newdomains',
+  // RIRs — IP/ASN lookups that often correlate with domain-intel research
+  'arin.net',
+  'ripe.net',
+  'apnic.net',
+  'lacnic.net',
+  'afrinic.net',
+  // ICANN zone data + lookup services (CZDS, etc.) — same family
+  'czds.icann.org',
+  'lookup.icann.org',
+  // Additional 2026-era aggregators / new-TLD registries
+  'centralnic',
+  'donuts.email',
+  'humbleworth',
+  'sav.com',
+  'spaceship',
+  // Cert Spotter API (we use it ourselves but track outbound for budget audit)
+  'api.certspotter.com',
 ];
 
 function classify(host) {

← 667159d register: fix Namecheap false-positive when API ok but regis · back to Domain Sniper · audit-noise: distinguish brand-match hits from BARE_PUNYCODE 1070e77 →